[Congressional Record Volume 147, Number 63 (Wednesday, May 9, 2001)]
[Senate]
[Pages S4591-S4597]
From the Congressional Record Online through the Government Publishing Office [www.gpo.gov]

      By Mrs. FEINSTEIN (for herself and Mr. Gregg):
  S. 848. A bill to amend title 18, United States Code, to limit the 
misuse of social security numbers, to establish criminal penalties for 
such misuse, and for other purposes; to the Committee on the Judiciary.
  Mrs. FEINSTEIN. Mr. President, I am pleased, along with Senator 
Gregg, to introduce the ``Social Security Number Misuse Prevention 
Act.'' This legislation combats identity theft by making it harder for 
criminals to steal another person's Social Security number, our de 
facto national identifier.
  The United States faces a growing identity theft crisis. The Federal 
Bureau of Investigation estimates 350,000 cases of identity theft occur 
each year. That's one case every two minutes.
  The Federal Trade Commission, FTC, reports that identity theft is the 
fastest growing crime in the country. If recent trends continue, 
reports of identity theft to the FTC will double between 2000 and 2001, 
to over 60,000 cases.

[[Page S4592]]

Fully 40 percent of all consumer fraud complaints received by the FTC 
in the first three months of 2001 involved identity theft.
  Unfortunately, the State most affected by these complaints is 
California. Fully 17 percent of the identity theft complaints the FTC 
received this past winter came from my home state.
  What is identity theft? Identity theft occurs when one person uses 
another person's Social Security number, birth date, driver's license 
number, or other identifying information to obtain credit cards, car 
loans, phone plans or other services in the victim's name.
  Identity thieves can get personal information in a myriad of ways, 
stealing wallets and purses containing identification cards, using 
personal information found on the Internet, stealing mail, including 
pre-approved credit offers and credit statements, fraudulently 
obtaining credit reports or getting personnel records at work.
  Of all sources of identity theft, the most common trigger of the 
crime is the misappropriation of a person's Social Security number. 
Reports to the Social Security Administration of the Social Security 
number misuse have increased from 7,868 in 1997 to 46,839 in 2000, an 
astonishing increase of over 500 percent.
  Let me give some examples of victims whose identities were stolen 
after a thief got hold of their Social Security number: An identity 
theft ring in Riverside County allegedly bilked eight victims of 
$700,000. The thieves stole personal information of employees at a 
large phone company and drained their on-line stock accounts. One 
employee reportedly had $285,000 taken from his account when someone 
was able to access his account by supplying the employee's name and 
social Security number. Three youths robbed a young woman on a San 
Francisco MUNI bus. The thieves stole her driver's license and social 
security card. While the victim was traveling over the Christmas 
holiday, the thieves represented themselves as her and drained her bank 
accounts, applied for cell phones, credit cards and other accounts. 
They also redirected her mail to a general delivery post to the 
Tenderloin. Amy Boyer, a 20 year-old dental assistant from Maine was 
killed in 1999 by a stalker who bought her Social Security number off 
the Internet for $45, and then used it to locate her work address. 
Michelle Brown of Los Angeles, California, had her Social Security 
number stolen in 1999, and it was used to charge $50,000 including a 
$32,000 truck, a $5,000 liposuction operation, and a year-long 
residential lease. While assuming the victim's name, the perpetrator 
also became the object of an arrest warrant for drug smuggling in 
Texas.
  This bill proposes concrete measures to get Social Security numbers 
beyond the reach of criminals.
  The bill prohibits anyone from selling or displaying a Social 
Security number to the general public without the Social Security 
number holder's consent.
  No longer will identity thieves or stalkers, like the man who killed 
Amy Boyer, be able to log anonymously onto a website and obtain another 
person's Social Security number. Information brokers will no longer be 
able to sell Social Security numbers to anyone who asks for a nominal 
fee.
  The bill also requires Federal, State, and local governments to take 
affirmative steps to protect Social Security numbers. Before giving out 
records such as bankruptcy filings, liens, or birth certificates to the 
general public, government entities will need to redact the Social 
Security number.
  Thus, identity thieves can no longer mine Social Security numbers 
from county clerks' offices or state records offices.
  In addition, the bill prohibits States from using Social Security 
numbers as identifying numbers on drivers licenses or printing Social 
Security numbers on checks.
  Privacy advocates contend half of all identity theft cases stem from 
lost or stolen wallets. Public entities should not put individuals at 
risk by requiring them to carry cards which contain Social Security 
numbers on them.
  In addition, the bill will empower individuals who wish to keep their 
Social Security numbers confidential and out of public circulation. 
Companies will be prohibited from denying an individual a good or 
service if he refuses to give out his Social Security number.
  In recognition of the needs of the business community, this 
legislation permits businesses to use Social Security numbers with 
appropriate safeguards for internal uses or in transactions with other 
businesses.
  I want to state up front that the business-to-business exception is 
an area of significant compromise. As a matter of policy, I believe 
that a Social Security number, like other sensitive elements of 
personal information, should be under the control of the person to whom 
it belongs.
  I also understand that many businesses, unfortunately, rely 
extensively on Social Security numbers to conduct a range of 
transactions. Some of these transactions include checking databases to 
ensure the identity of a customer or purchaser.
  The cost of changing to other identifiers can be significant. One 
California health care company, for example, conducted an internal 
study on how much it would cost to switch from Social Security numbers 
to another customer identifier. The price tag was over $25 million.
  The bill directs the Attorney General to implement rules to permit 
legitimate business-to-business transactions, but prevent abuse. The 
Attorney general must consider several factors in the rulemaking: (i) 
The need for appropriate safeguards so that employees cannot 
misappropriate Social Security numbers, and (ii) The need to implement 
procedures to prevent identity thieves, stalkers, and others with ill 
intent from posing as legitimate businesses to obtain Social Security 
numbers.
  In drafting the rule, the Attorney General must ensure that any 
business-to-businesss exception is consistent with other privacy laws, 
including Gramm-Leach-Bliley.
  Thus, the bill would be consistent with a district court ruling 
issued last week that recognized limits on financial institutions' use 
of Social Security numbers. In Individual Reference Services Group v. 
Federal Trade Commission, the court held Gramm-Leach-Bliley requires 
banks to give consumers the opportunity to opt-out before their Social 
Security number is sold. I would like to submit into the record a copy 
of a Los Angeles Times article describing the decision.
  I would like to thank Senator Gregg for working so hard with me to 
draft this legislation. I am pleased to report that this bill has 
garnered the support of the Attorney General of California, Bill 
Lockyer, Los Angeles County Sheriff Lee Baca, Crimes Victims United of 
California, the Los Angeles Coalition of Crime Victim Advocates, and 
the Doris Tate Crime Victims Bureau.
  Over 350,000 people a year are victims of identity theft, and the 
numbers continue to grow. Passing the ``Social Security Number Misuse 
Prevention Act'' will help curb this crime by restricting criminal 
access to Social Security numbers.
  I look forward to working with my colleagues in getting this common-
sense bill enacted into law.
  I ask unanimous consent that the text of the bill and the article to 
which I referred be printed in the Record.
  There being no objection, the material was ordered to be printed in 
the Record, as follows:

                                 S. 848

       Be it enacted by the Senate and House of Representatives of 
     the United States of America in Congress assembled,

     SECTION 1. SHORT TITLE; TABLE OF CONTENTS.

       (a) Short Title.--This Act may be cited as the ``Social 
     Security Number Misuse Prevention Act of 2001''.
       (b) Table of Contents.--The table of contents of this Act 
     is as follows:

Sec. 1. Short title; table of contents.
Sec. 2. Findings.
Sec. 3. Prohibition of the display, sale, or purchase of social 
              security numbers.
Sec. 4. No prohibition with respect to public records.
Sec. 5. Rulemaking authority of the Attorney General.
Sec. 6. Treatment of social security numbers on government documents.
Sec. 7. Limits on personal disclosure of a social security number for 
              consumer transactions.
Sec. 8. Extension of civil monetary penalties for misuse of a social 
              security number.

     SEC. 2. FINDINGS.

       Congress makes the following findings:
       (1) The inappropriate display, sale, or purchase of social 
     security numbers has contributed to a growing range of 
     illegal activities,

[[Page S4593]]

     including fraud, identity theft, and, in some cases, stalking 
     and other violent crimes.
       (2) While financial institutions, health care providers, 
     and other entities have often used social security numbers to 
     confirm the identity of an individual, the general display to 
     the public, sale, or purchase of these numbers has been used 
     to commit crimes, and also can result in serious invasions of 
     individual privacy.
       (3) The Federal Government requires virtually every 
     individual in the United States to obtain and maintain a 
     social security number in order to pay taxes, to qualify for 
     social security benefits, or to seek employment. An 
     unintended consequence of these requirements is that social 
     security numbers have become tools that can be used to 
     facilitate crime, fraud, and invasions of the privacy of the 
     individuals to whom the numbers are assigned. Because the 
     Federal Government created and maintains this system, and 
     because the Federal Government does not permit individuals to 
     exempt themselves from those requirements, it is appropriate 
     for the Federal Government to take steps to stem the abuse of 
     this system.
       (4) A social security number does not contain, reflect, or 
     convey any publicly significant information or concern any 
     public issue. The display, sale, or purchase of such numbers 
     in no way facilitates uninhibited, robust, and wide-open 
     public debate, and restrictions on such display, sale, or 
     purchase would not affect public debate.
       (5) No one should seek to profit from the display, sale, or 
     purchase of social security numbers in circumstances that 
     create a substantial risk of physical, emotional, or 
     financial harm to the individuals to whom those numbers are 
     assigned.
       (6) Consequently, this Act offers each individual that has 
     been assigned a social security number necessary protection 
     from the display, sale, and purchase of that number in any 
     circumstance that might facilitate unlawful conduct.

     SEC. 3. PROHIBITION OF THE DISPLAY, SALE, OR PURCHASE OF 
                   SOCIAL SECURITY NUMBERS.

       (a) Prohibition.--
       (1) In general.--Chapter 47 of title 18, United States 
     Code, is amended by inserting after section 1028 the 
     following:

     ``Sec. 1028A. Prohibition of the display, sale, or purchase 
       of social security numbers

       ``(a) Definitions.--In this section:
       ``(1) Display.--The term `display' means to intentionally 
     communicate or otherwise make available (on the Internet or 
     in any other manner) to the general public an individual's 
     social security number.
       ``(2) Person.--The term `person' means any individual, 
     partnership, corporation, trust, estate, cooperative, 
     association, or any other entity.
       ``(3) Purchase.--The term `purchase' means providing 
     directly or indirectly, anything of value in exchange for a 
     social security number.
       ``(4) Sale.--The term `sale' means obtaining, directly or 
     indirectly, anything of value in exchange for a social 
     security number.
       ``(5) State.--The term `State' means any State of the 
     United States, the District of Columbia, Puerto Rico, the 
     Northern Mariana Islands, the United States Virgin Islands, 
     Guam, American Samoa, and any territory or possession of the 
     United States.
       ``(b) Limitation on Display.--Except as provided in section 
     1028B, no person may display any individual's social security 
     number to the general public without the affirmatively 
     expressed consent of the individual.
       ``(c) Limitation on Sale or Purchase.--Except as otherwise 
     provided in this section, no person may sell or purchase any 
     individual's social security number without the affirmatively 
     expressed consent of the individual.
       ``(d) Prohibition of Wrongful Use as Personal 
     Identification Number.--No person may obtain any individual's 
     social security number for purposes of locating or 
     identifying an individual with the intent to physically 
     injure, harm, or use the identity of the individual for any 
     illegal purpose.
       ``(e) Prerequisites for Consent.--In order for consent to 
     exist under subsection (b) or (c), the person displaying or 
     seeking to display, selling or attempting to sell, or 
     purchasing or attempting to purchase, an individual's social 
     security number shall--
       ``(1) inform the individual of the general purpose for 
     which the number will be used, the types of persons to whom 
     the number may be available, and the scope of transactions 
     permitted by the consent; and
       ``(2) obtain the affirmatively expressed consent 
     (electronically or in writing) of the individual.
       ``(f) Exceptions.--
       ``(1) In general.--Except as provided in subsection (d), 
     nothing in this section shall be construed to prohibit or 
     limit the display, sale, or purchase of a social security 
     number--
       ``(A) permitted, required, or excepted, expressly or by 
     implication, under section 205(c)(2), 1124A(a)(3), or 1141(c) 
     of the Social Security Act (42 U.S.C. 405(c)(2), 1320a-
     3a(a)(3), and 1320b-11(c)), section 7(a)(2) of the Privacy 
     Act of 1974 (5 U.S.C. 552a note), section 6109(d) of the 
     Internal Revenue Code of 1986, or section 6(b)(1) of the 
     Professional Boxing Safety Act of 1996 (15 U.S.C. 
     6305(b)(1));
       ``(B) for a public health purpose, including the protection 
     of the health or safety of an individual in an emergency 
     situation;
       ``(C) for a national security purpose;
       ``(D) for a law enforcement purpose, including the 
     investigation of fraud, as required under subchapter II of 
     chapter 53 of title 31, United States Code, and chapter 2 of 
     title I of Public Law 91-508 (12 U.S.C. 1951-1959), and the 
     enforcement of a child support obligation;
       ``(E) if the display, sale, or purchase of the number is 
     for a business-to-business use, including, but not limited 
     to--
       ``(i) the prevention of fraud (including fraud in 
     protecting an employee's right to employment benefits);
       ``(ii) the facilitation of credit checks or the 
     facilitation of background checks of employees, prospective 
     employees, and volunteers;
       ``(iii) compliance with any requirement related to the 
     social security program established under title II of the 
     Social Security Act (42 U.S.C. 401 et seq.); or
       ``(iv) the retrieval of other information from, or by, 
     other businesses, commercial enterprises, or private 
     nonprofit organizations,

     except that, nothing in this subparagraph shall be construed 
     as permitting a professional or commercial user to display or 
     sell a social security number to the general public;
       ``(F) if the transfer of such a number is part of a data 
     matching program under the Computer Matching and Privacy 
     Protection Act of 1988 (5 U.S.C. 552a note) or any similar 
     computer data matching program involving a Federal, State, or 
     local agency; or
       ``(G) if such number is required to be submitted as part of 
     the process for applying for any type of Federal, State, or 
     local government benefit or program.
       ``(g) Civil Action in United States District Court; 
     Damages; Attorney's Fees and Costs.--
       ``(1) In general.--Any individual aggrieved by any act of 
     any person in violation of this section may bring a civil 
     action in a United States district court to recover--
       ``(A) such preliminary and equitable relief as the court 
     determines to be appropriate; and
       ``(B) the greater of--
       ``(i) actual damages;
       ``(ii) liquidated damages of $2,500; or
       ``(iii) in the case of a violation that was willful and 
     resulted in profit or monetary gain, liquidated damages of 
     $10,000.
       ``(2) Statute of limitations.--No action may be commenced 
     under this subsection more than 3 years after the date on 
     which the violation was or should reasonably have been 
     discovered by the aggrieved individual.
       ``(3) Nonexclusive remedy.--The remedy provided under this 
     subsection shall be in addition to any other remedy available 
     to the individual.
       ``(h) Civil Penalties.--
       ``(1) In general.--Any person who the Attorney General 
     determines has violated this section shall be subject, in 
     addition to any other penalties that may be prescribed by 
     law--
       ``(A) to a civil penalty of not more than $5,000 for each 
     such violation; and
       ``(B) to a civil penalty of not more than $50,000, if the 
     violations have occurred with such frequency as to constitute 
     a general business practice.
       ``(2) Determination of violations.--Any willful violation 
     committed contemporaneously with respect to the social 
     security numbers of 2 or more individuals by means of mail, 
     telecommunication, or otherwise, shall be treated as a 
     separate violation with respect to each such individual.
       ``(3) Enforcement procedures.--The provisions of section 
     1128A of the Social Security Act (42 U.S.C. 1320a-7a), other 
     than subsections (a), (b), (f), (h), (i), (j), (m), and (n) 
     and the first sentence of subsection (c) of such section, and 
     the provisions of subsections (d) and (e) of section 205 of 
     such Act (42 U.S.C. 405) shall apply to a civil penalty under 
     this subsection in the same manner as such provisions apply 
     to a penalty or proceeding under section 1128A(a) of such Act 
     (42 U.S.C. 1320a-7a(a)), except that, for purposes of this 
     paragraph, any reference in section 1128A of such Act (42 
     U.S.C. 1320a-7a) to the Secretary shall be deemed to be a 
     reference to the Attorney General.''.
       (2) Conforming amendment.--The chapter analysis for chapter 
     47 of title 18, United States Code, is amended by inserting 
     after the item relating to section 1028 the following:

``1028A. Prohibition of the display, sale, or purchase of social 
              security numbers.''.

       (b) Criminal Sanctions.--Section 208(a) of the Social 
     Security Act (42 U.S.C. 408(a)) is amended--
       (1) in paragraph (8), by inserting ``or'' after the 
     semicolon; and
       (2) by inserting after paragraph (8) the following new 
     paragraphs:
       ``(9) except as provided in paragraph (5) of section 
     1028A(a) of title 18, United States Code, knowingly and 
     willfully displays, sells, or purchases (as those terms are 
     defined in paragraph (1) of such section) any individual's 
     social security number (as defined in such paragraph) without 
     the affirmatively expressed consent of that individual after 
     having met the prerequisites for consent under paragraph (4) 
     of such section, electronically or in writing, with respect 
     to that individual; or
       ``(10) obtains any individual's social security number for 
     the purpose of locating or identifying the individual with 
     the intent to injure or to harm that individual, or to use 
     the identity of that individual for an illegal purpose;''.

[[Page S4594]]

       (c) Effective Date.--Section 1028A of title 18, United 
     States Code (as added by subsection (a)), and section 208 of 
     the Social Security Act (42 U.S.C. 408) (as amended by 
     subsection (b)) shall take effect 30 days after the date on 
     which the final regulations promulgated under section 5(b) 
     are published in the Federal Register.

     SEC. 4. NO PROHIBITION WITH RESPECT TO PUBLIC RECORDS.

       (a) Public Records Exception.--
       (1) In general.--Chapter 47 of title 18, United States Code 
     (as amended by section 3(a)(1)), is amended by inserting 
     after section 1028A the following:

     ``Sec. 1028B. No prohibition of the display, sale, or 
       purchase of social security numbers included in public 
       records

       ``(a) In General.--Nothing in section 1028A shall be 
     construed to prohibit or limit the display, sale, or purchase 
     of any public record which includes a social security number 
     that--
       ``(1) is incidentally included in a public record, as 
     defined in subsection (d);
       ``(2) is intended to be purchased, sold, or displayed 
     pursuant to an exception contained in section 1028A(f);
       ``(3) is intended to be purchased, sold, or displayed 
     pursuant to the consent provisions of subsections (b), (c), 
     and (e) of section 1028A; or
       ``(4) includes a redaction of the nonincidental occurrences 
     of the social security numbers when sold or displayed to 
     members of the general public.
       ``(b) Agency Requirements.--Each agency in possession of 
     documents that contain social security numbers which are 
     nonincidental, shall, with respect to such documents--
       ``(1) ensure that access to such numbers is restricted to 
     persons who may obtain them in accordance with applicable 
     law;
       ``(2) require an individual who is not exempt under section 
     1028A(f) to provide the social security number of the person 
     who is the subject of the document before making such 
     document available; or
       ``(3) redact the social security number from the document 
     prior to providing a copy of the requested document to an 
     individual who is not exempt under section 1028A(f) and who 
     is unable to provide the social security number of the person 
     who is the subject of the document.
       ``(c) Rule of Construction.--Nothing in this section shall 
     be used as a basis for permitting or requiring a State or 
     local government entity or other repository of public 
     documents to expand or to limit access to documents 
     containing social security numbers to entities covered by the 
     exception in section 1028A(f).
       ``(d) Definitions.--In this section:
       ``(1) Incidental.--The term `incidental' means that the 
     social security number is not routinely displayed in a 
     consistent and predictable manner on the public record by a 
     government entity, such as on the face of a document.
       ``(2) Public record.--The term `public record' means any 
     item, collection, or grouping of information about an 
     individual that is maintained by a Federal, State, or local 
     government entity and that is made available to the 
     public.''.
       (2) Conforming amendment.--The chapter analysis for chapter 
     47 of title 18, United States Code (as amended by section 
     3(a)(2)), is amended by inserting after the item relating to 
     section 1028A the following:

``1028B. No prohibition of the display, sale, or purchase of social 
              security numbers included in public records.''.

     SEC. 5. RULEMAKING AUTHORITY OF THE ATTORNEY GENERAL.

       (a) In General.--Except as provided in subsection (b), the 
     Attorney General may prescribe such rules and regulations as 
     the Attorney General deems necessary to carry out the 
     provisions of section 3.
       (b) Business-to-Business Commercial Display, Sale, or 
     Purchase Rulemaking.--
       (1) In general.--Not later than 1 year after the date of 
     enactment of this Act, the Attorney General, in consultation 
     with the Commissioner of Social Security, the Federal Trade 
     Commission, and such other Federal agencies as the Attorney 
     General determines appropriate, may conduct such rulemaking 
     procedures in accordance with subchapter II of chapter 5 of 
     title 5, United States Code, as are necessary to promulgate 
     regulations to implement and clarify the business-to-business 
     provisions pertaining to section 1028A(f)(1)(E) of title 18, 
     United States Code (as added by section 3(a)(1)). The 
     Attorney General shall consult with other agencies to ensure, 
     where possible, that these provisions are consistent with 
     other privacy laws, including title V of the Gramm-Leach-
     Bliley Act (15 U.S.C. 6801 et seq.).
       (2) Factors to be considered.--In promulgating the 
     regulations required under paragraph (1), the Attorney 
     General shall, at a minimum, consider the following factors:
       (A) The benefit to a particular business practice and to 
     the general public of the sale or purchase of an individual's 
     social security number.
       (B) The risk that a particular business practice will 
     promote the use of the social security number to commit 
     fraud, deception, or crime.
       (C) The presence of adequate safeguards to prevent the 
     misappropriation of social security numbers by the general 
     public , while permitting internal business uses of such 
     numbers.
       (D) The implementation of procedures to prevent identity 
     thieves, stalkers, and others with ill intent from posing as 
     legitimate businesses to obtain social security numbers.

     SEC. 6. TREATMENT OF SOCIAL SECURITY NUMBERS ON GOVERNMENT 
                   DOCUMENTS.

       (a) Prohibition of Use of Social Security Account Numbers 
     on Checks Issued for Payment by Governmental Agencies.--
       (1) In general.--Section 205(c)(2)(C) of the Social 
     Security Act (42 U.S.C. 405(c)(2)(C)) is amended by adding at 
     the end the following new clause:
       ``(x) No Federal, State, or local agency may display the 
     social security account number of any individual, or any 
     derivative of such number, on any check issued for any 
     payment by the Federal, State, or local agency.''.
       (2) Effective date.--The amendment made by this subsection 
     shall apply with respect to violations of section 
     205(c)(2)(C)(x) of the Social Security Act (42 U.S.C. 
     405(c)(2)(C)(x)), as added by paragraph (1), occurring after 
     the date that is 3 years after the date of enactment of this 
     Act.
       (b) Prohibition of Appearance of Social Security Account 
     Numbers on Driver's Licenses or Motor Vehicle Registration.--
       (1) In general.--Section 205(c)(2)(C)(vi) of the Social 
     Security Act (42 U.S.C. 405(c)(2)(C)(vi)) is amended--
       (A) by inserting ``(I)'' after ``(vi)''; and
       (B) by adding at the end the following new subclause:
       ``(II)(aa) An agency of a State (or political subdivision 
     thereof), in the administration of any driver's license or 
     motor vehicle registration law within its jurisdiction, may 
     not disclose the social security account numbers issued by 
     the Commissioner of Social Security, or any derivative of 
     such numbers, on any driver's license or motor vehicle 
     registration or any other document issued by such State (or 
     political subdivision thereof) to an individual for purposes 
     of identification of such individual.
       ``(bb) Nothing in this subclause shall be construed as 
     precluding an agency of a State (or political subdivision 
     thereof), in the administration of any driver's license or 
     motor vehicle registration law within its jurisdiction, from 
     using a social security account number for an internal use or 
     to link with the database of an agency of another State that 
     is responsible for the administration of any driver's license 
     or motor vehicle registration law.''.
       (2) Effective date.--The amendment made by this subsection 
     shall apply with respect to licenses, registrations, and 
     other documents issued or reissued after the date that is 1 
     year after the date of enactment of this Act.
       (c) Prohibition of Inmate Access to Social Security Account 
     Numbers.--
       (1) In general.--Section 205(c)(2)(C) of the Social 
     Security Act (42 U.S.C. 405(c)(2)(C)) (as amended by 
     subsection (b)) is amended by adding at the end the following 
     new clause:
       ``(xi) No Federal, State, or local agency may employ, or 
     enter into a contract for the use or employment of, prisoners 
     in any capacity that would allow such prisoners access to the 
     social security account numbers of other individuals. For 
     purposes of this clause, the term `prisoner' means an 
     individual confined in a jail, prison, or other penal 
     institution or correctional facility pursuant to such 
     individual's conviction of a criminal offense.''.
       (2) Effective date.--The amendment made by this subsection 
     shall apply with respect to employment of prisoners, or entry 
     into contract with prisoners, after the date that is 1 year 
     after the date of enactment of this Act.

     SEC. 7. LIMITS ON PERSONAL DISCLOSURE OF A SOCIAL SECURITY 
                   NUMBER FOR CONSUMER TRANSACTIONS.

       (a) In General.--Part A of title XI of the Social Security 
     Act (42 U.S.C. 1301 et seq.) is amended by adding at the end 
     the following new section:

     ``SEC. 1150A. LIMITS ON PERSONAL DISCLOSURE OF A SOCIAL 
                   SECURITY NUMBER FOR CONSUMER TRANSACTIONS.

       ``(a) In General.--A commercial entity may not require an 
     individual to provide the individual's social security number 
     when purchasing a commercial good or service or deny an 
     individual the good or service for refusing to provide that 
     number except--
       ``(1) for any purpose relating to--
       ``(A) obtaining a consumer report for any purpose permitted 
     under the Fair Credit Reporting Act;
       ``(B) a background check of the individual conducted by a 
     landlord, lessor, employer, voluntary service agency, or 
     other entity as determined by the Attorney General;
       ``(C) law enforcement; or
       ``(D) a Federal or State law requirement; or
       ``(2) if the social security number is necessary to verify 
     identity and to prevent fraud with respect to the specific 
     transaction requested by the consumer and no other form of 
     identification can produce comparable information.
       ``(b) Other Forms of Identification.--Nothing in this 
     section shall be construed to prohibit a commercial entity 
     from--
       ``(1) requiring an individual to provide 2 forms of 
     identification that do not contain the social security number 
     of the individual; or
       ``(2) denying an individual a good or service for refusing 
     to provide 2 forms of identification that do not contain such 
     number.

[[Page S4595]]

       ``(c) Application of Civil Money Penalties.--A violation of 
     this section shall be deemed to be a violation of section 
     1129(a)(3)(F).
       ``(d) Application of Criminal Penalties.--A violation of 
     this section shall be deemed to be a violation of section 
     208(a)(8).''.
       (b) Effective Date.--The amendment made by subsection (a) 
     shall apply to requests to provide a social security number 
     made on or after the date of enactment of this Act.

     SEC. 8. EXTENSION OF CIVIL MONETARY PENALTIES FOR MISUSE OF A 
                   SOCIAL SECURITY NUMBER.

       (a) Treatment of Withholding of Material Facts.--
       (1) Civil penalties.--The first sentence of section 
     1129(a)(1) of the Social Security Act (42 U.S.C. 1320a-
     8(a)(1)) is amended--
       (A) by striking ``who'' and inserting ``who--'';
       (B) by striking ``makes'' and all that follows through 
     ``shall be subject to'' and inserting the following:
       ``(A) makes, or causes to be made, a statement or 
     representation of a material fact, for use in determining any 
     initial or continuing right to or the amount of monthly 
     insurance benefits under title II or benefits or payments 
     under title VIII or XVI, that the person knows or should know 
     is false or misleading;
       ``(B) makes such a statement or representation for such use 
     with knowing disregard for the truth; or
       ``(C) omits from a statement or representation for such 
     use, or otherwise withholds disclosure of, a fact which the 
     individual knows or should know is material to the 
     determination of any initial or continuing right to or the 
     amount of monthly insurance benefits under title II or 
     benefits or payments under title VIII or XVI and the 
     individual knows, or should know, that the statement or 
     representation with such omission is false or misleading or 
     that the withholding of such disclosure is misleading,

     shall be subject to'';
       (C) by inserting ``or each receipt of such benefits while 
     withholding disclosure of such fact'' after ``each such 
     statement or representation'';
       (D) by inserting ``or because of such withholding of 
     disclosure of a material fact'' after ``because of such 
     statement or representation''; and
       (E) by inserting ``or such a withholding of disclosure'' 
     after ``such a statement or representation''.
       (2) Administrative procedure for imposing penalties.--The 
     first sentence of section 1129A(a) of the Social Security Act 
     (42 U.S.C. 1320a-8a(a)) is amended--
       (A) by striking ``who'' and inserting ``who--''; and
       (B) by striking ``makes'' and all that follows through 
     ``shall be subject to'' and inserting the following new 
     paragraphs:
       ``(1) makes, or causes to be made, a statement or 
     representation of a material fact, for use in determining any 
     initial or continuing right to or the amount of monthly 
     insurance benefits under title II or benefits or payments 
     under title VIII or XVI, that the person knows or should know 
     is false or misleading;
       ``(2) makes such a statement or representation for such use 
     with knowing disregard for the truth; or
       ``(3) omits from a statement or representation for such 
     use, or otherwise withholds disclosure of, a fact which the 
     individual knows or should know is material to the 
     determination of any initial or continuing right to or the 
     amount of monthly insurance benefits under title II or 
     benefits or payments under title VIII or XVI and the 
     individual knows, or should know, that the statement or 
     representation with such omission is false or misleading or 
     that the withholding of such disclosure is misleading,

     shall be subject to''.
       (b) Application of Civil Money Penalties to Elements of 
     Criminal Violations.--Section 1129(a) of the Social Security 
     Act (42 U.S.C. 1320a-8(a)), as amended by subsection (a)(1), 
     is amended--
       (1) by redesignating paragraph (2) as paragraph (4);
       (2) by redesignating the last sentence of paragraph (1) as 
     paragraph (2) and inserting such paragraph after paragraph 
     (1); and
       (3) by inserting after paragraph (2) (as so redesignated) 
     the following new paragraph:
       ``(3) Any person (including an organization, agency, or 
     other entity) who--
       ``(A) uses a social security account number that such 
     person knows or should know has been assigned by the 
     Commissioner of Social Security (in an exercise of authority 
     under section 205(c)(2) to establish and maintain records) on 
     the basis of false information furnished to the Commissioner 
     by any person;
       ``(B) falsely represents a number to be the social security 
     account number assigned by the Commissioner of Social 
     Security to any individual, when such person knows or should 
     know that such number is not the social security account 
     number assigned by the Commissioner to such individual;
       ``(C) knowingly alters a social security card issued by the 
     Commissioner of Social Security, or possesses such a card 
     with intent to alter it;
       ``(D) knowingly displays, sells, or purchases a card that 
     is, or purports to be, a card issued by the Commissioner of 
     Social Security, or possesses such a card with intent to 
     display, purchase, or sell it;
       ``(E) counterfeits a social security card, or possesses a 
     counterfeit social security card with intent to display, 
     sell, or purchase it;
       ``(F) discloses, uses, compels the disclosure of, or 
     knowingly displays, sells, or purchases the social security 
     account number of any person in violation of the laws of the 
     United States;
       ``(G) with intent to deceive the Commissioner of Social 
     Security as to such person's true identity (or the true 
     identity of any other person) furnishes or causes to be 
     furnished false information to the Commissioner with respect 
     to any information required by the Commissioner in connection 
     with the establishment and maintenance of the records 
     provided for in section 205(c)(2);
       ``(H) offers, for a fee, to acquire for any individual, or 
     to assist in acquiring for any individual, an additional 
     social security account number or a number which purports to 
     be a social security account number; or
       ``(I) being an officer or employee of a Federal, State, or 
     local agency in possession of any individual's social 
     security account number, willfully acts or fails to act so as 
     to cause a violation by such agency of clause (vi)(II) or (x) 
     of section 205(c)(2)(C),

     shall be subject to, in addition to any other penalties that 
     may be prescribed by law, a civil money penalty of not more 
     than $5,000 for each violation. Such person shall also be 
     subject to an assessment, in lieu of damages sustained by the 
     United States resulting from such violation, of not more than 
     twice the amount of any benefits or payments paid as a result 
     of such violation.''.
       (c) Clarification of Treatment of Recovered Amounts.--
     Section 1129(e)(2)(B) of the Social Security Act (42 U.S.C. 
     1320a-8(e)(2)(B)) is amended by striking ``In the case of 
     amounts recovered arising out of a determination relating to 
     title VIII or XVI,'' and inserting ``In the case of any other 
     amounts recovered under this section,''.
       (d) Conforming Amendments.--
       (1) Section 1129(b)(3)(A) of the Social Security Act (42 
     U.S.C. 1320a-8(b)(3)(A)) is amended by striking ``charging 
     fraud or false statements''.
       (2) Section 1129(c)(1) of the Social Security Act (42 
     U.S.C. 1320a-8(c)(1)) is amended by striking ``and 
     representations'' and inserting ``, representations, or 
     actions''.
       (3) Section 1129(e)(1)(A) of the Social Security Act (42 
     U.S.C. 1320a-8(e)(1)(A)) is amended by striking ``statement 
     or representation referred to in subsection (a) was made'' 
     and inserting ``violation occurred''.
       (e) Effective Dates.--
       (1) In general.--Except as provided in paragraph (2), the 
     amendments made by this section shall apply with respect to 
     violations of sections 1129 and 1129A of the Social Security 
     Act (42 U.S.C. 1320-8 and 1320a-8a), as amended by this 
     section, committed after the date of enactment of this Act.
       (2) Violations by government agents in possession of social 
     security numbers.--Section 1129(a)(3)(I) of the Social 
     Security Act (42 U.S.C. 1320a-8(a)(3)(I)), as added by 
     subsection (b), shall apply with respect to violations of 
     that section occurring on or after the effective date under 
     section 3(c).
                                  ____


               [From the Los Angeles Times, May 8, 2001]

                  Curb on Sale of Consumer Data Upheld

                          (By Edmund Sanders)

       Washington.--In a victory for privacy advocates, a federal 
     judge has upheld a proposed government regulation that would 
     effectively end the long-standing practice by credit bureaus 
     of selling consumers' names, addresses and Social Security 
     numbers to marketers, information brokers and others.
       Industry groups are likely to appeal the decision by 
     District Judge Ellen Segal Huvelle, which was disclosed 
     Monday by the Federal Trade Commission. If the decision is 
     upheld, the rule--issued by the FTC last year and set to take 
     effect in July--would work dramatic changes in the way 
     businesses rely upon the credit bureaus' databases for 
     everything from updating junk-mail lists to locating debtors.
       ``It's going to set a higher barrier for the privacy of 
     this kind of information,'' said Robert Gellman, a privacy 
     consultant in Washington.
       Credit bureaus and information brokers, who filed suit last 
     year to block the FTC rules, warned that the court decision 
     may have unintended consequences.
       ``There are many beneficial uses for this information,'' 
     said Clark Walter, a spokesman for Trans Union, the Chicago-
     based credit bureau. He said the databases are used to find 
     fugitives, parents who owe child support, missing heirs and 
     runaway children. ``How these particular functions would be 
     affected remains to be seen,'' Walter said.
       At the heart of the dispute is the top portion of consumer 
     credit reports, known as the credit ``header,'' which is 
     typically limited to a person's name, address, birth date and 
     Social Security number. The header does not include financial 
     information about credit history or bank accounts, which can 
     be released only to creditors and others with a legal right 
     to see it.
       Because it has been considered less sensitive, credit 
     header information has been sold for years. Customers include 
     marketing firms, law enforcement agencies, private 
     investigators and journalists.
       Last year, the FTC issued rules to prohibit credit bureaus 
     from continuing to sell the information unless consumers had 
     first been given an opportunity to block the practice. The 
     agency said the rule was mandated by Congress as part of a 
     1999 financial modernization law, which called for new 
     privacy

[[Page S4596]]

     protections for consumers' financial information.
       The Individual Reference Services Group, a trade group of 
     information companies, argued that the FTC had misinterpreted 
     the law. ``We don't think a name and address is `financial 
     information' under the statute,'' said Ronald Plesser, 
     attorney for the trade group. The companies also argued that 
     the rules violated their constitutional right to free speech.
       The FTC countered that any personally identifiable 
     information provided to financial institutions, even if 
     available from other public sources, should be covered by the 
     law.
       The disclosure of Social Security numbers, in particular, 
     raised the hackles of privacy advocates, who say the practice 
     has led to an increase in identity theft and other fraud.
       In her 62-page ruling, dated April 30, Huvelle said the 
     regulations were lawful and constitutional. ``This gives 
     consumer more control over how their information is used,'' 
     said John Daly, assistant general counsel at the FTC.
       The decision marks the latest defeat for credit bureaus and 
     information brokers, whose operating environment is 
     increasingly hostile.
       A federal appeals court ruled last month that Trans Union 
     may no longer sell marketing lists based upon certain 
     financial characteristics, such as consumers with three or 
     more credit cards, culled from credit reports.
       The FTC banned the practice in 1992, saying it violated 
     federal laws prohibiting the use of credit information for 
     marketing purposes. The other two major credit bureaus halted 
     the practice, but Trans Union continued to sell such lists.
       If credit bureaus are prohibited from selling credit header 
     data, businesses will probably turn to other sources, such as 
     the change-of-address database at the U.S. Postal Service or 
     voter registration records.

  Mr. GREGG. Mr. President, on October 15, 1999, Amy Boyer, a young 
woman from Nashua, NH, was killed by a man who went on the Internet, 
purchased her social security number for $45, used it to find her place 
of work and kill her.
  As a result of that tragic event, and countless others I have 
subsequently become aware of, it became clear to me that the sale of 
social security numbers on the Internet was dangerous and needed to be 
stopped.
  Last year, I introduced Amy Boyer's law to do just that. The purpose 
of that legislation was twofold. First, to ensure that people like Amy 
Boyer's killer would not be able to purchase social security numbers 
and second, to prevent companies like Dogpile, and Docusearch.com from 
being able to sell social security numbers without an individual's 
consent.
  Amy Boyer's law accomplished both of these objectives but became 
mired down in controversy, frankly from both sides, over how to strike 
a balance between legitimate business and other lawful uses of the 
social security number which are necessary in many instances to prevent 
fraud and identity theft and a desire on the part of the privacy 
organizations to significantly limit public access to social security 
numbers.
  Let's face it, like it or not, the Social Security Number has become 
a national identifier of sorts and in many instances, is the only way 
to ensure accurate identification of people. Health care providers use 
the social security number to maintain our health records to ensure we 
are receiving the services we need; banks and financial institutions 
use them to prevent fraud--a social security number tells them that a 
loan applicant is exactly who he says he is. The National Center for 
Missing and Exploited Children and the Association for Children for 
Enforcement of Support, ACES, use social security numbers to track down 
kidnappers and deadbeat dads. Big Brothers/Big Sisters of America use 
social security numbers to do background checks on volunteers to make 
sure that they are not felons or child molesters. A truly blanket 
prohibition that did not include any exceptions whatsoever would close-
out the above uses. In reality, nobody wants this.
  Unfortunately, we were unable to reach a suitable compromise before 
adjourning last session, but I am pleased today to introduce, with 
Senator Feinstein, after many months of very hard work, the Social 
Security Number Misuse Prevention Act of 2001.
  This is indeed a compromise proposal. Both Senator Feinstein and 
myself have had countless meetings with parties interested in this 
issue and have produced, what I believe to be, a good product. It is 
not a perfect product, but it is a good first step toward balancing 
significant diverging interests. We will, of course, continue to work 
with interested parties to perfect this legislation, but we have agreed 
in concept to certain key principles.
  First, the public access to the social security number must be 
limited because of the significant risk of invasions of privacy and the 
potential for misuse, not the least of which is identity theft. And 
second, that there are certain legitimate purposes for which the social 
security number is essential--and we must protect those legitimate 
uses.
  Let me summarize the bill's main provisions:
  First, the legislation contains a prohibition against obtaining 
social security number with wrongful intent. Persons are prohibited 
from obtaining a social security number for the purpose of locating or 
identifying an individual with the intent to physically injure, harm, 
or use the identity of the individual for any illegal purpose.
  Second, the legislation prohibits the display, sale and purchase of 
social security numbers to and by the general public without the 
individual's consent, except for certain limited purposes. Those 
purposes include: For purposes permitted, required or excepted under 
the Social Security Act, section 7 (a)(2) of the Privacy Act of 1974, 
section 6109(d) of the Internal Revenue Code of 1986 or section 6(b)(1) 
of the Professional Boxing Safety Act of 1996: for a public health 
purpose, including the protection of the health and safety of an 
individual or in an emergency situation; for a national security 
purpose; for a law enforcement purpose, including the investigation of 
fraud and the enforcement of child support obligations; for business-
to-business use, including, but not limited to the prevention of fraud, 
the facilitation of credit checks or background checks of employees, 
prospective employees, and volunteers, compliance with any requirement 
related to the social security program, or the retrieval of other 
information from other businesses or commercial enterprises; except 
that no business may sell or display a social security number to the 
general public. For data matching programs under the Computer Matching 
and Privacy Protection Act of 1988 or any similar data matching program 
involving a Federal, State or local agency; or if such number is 
required to be submitted as part of the process for applying for any 
type of Federal, State, or local government benefit or program.
  Third, an individual may not be required to provide their social 
security number when purchasing a commercial good or service unless the 
social security number is necessary: For purposes relating to the Fair 
Credit Reporting Act, for a background check of the individual 
conducted by a landlord, lessor, employer, volunteer service agency, or 
other entity determined by the Attorney General, for law enforcement, 
or pursuant to a Federal or State law requirement; or if the social 
security number is necessary to verify identity and prevent fraud with 
respect to the specific transaction requested by the consumer and no 
other form of identification can produce comparable information.
  Fourth, within 3 years after the date of enactment of this 
legislation, Social Security numbers may not appear on checks issued 
for payment by Federal, State, or local government agencies.
  Fifth, within 1 year after the date of enactment of this legislation, 
Social Security numbers may not appear on any driver's license, motor 
vehicle registration or any other document issued to an individual for 
purposes of identification of such individual. However, State 
Departments of Motor Vehicles may continue to use social security 
numbers internally and for purposes of sharing information about 
driving records with other jurisdictions.
  Sixth, the legislation prohibits prisoners from gaining access to 
social security numbers.
  Finally, on the issue of Public Records, which was and remains a very 
difficult issue. In fact, last year, it was one of the issues that 
resulted in our inability to pass Amy Boyer's Law. Amy Boyer's law 
allowed Social Security Numbers to continue to appear in public records 
with no limitation on access. It did so in recognition of the fact that 
many states, local governments, and other governmental entities use 
Social Security Numbers in the same way that many businesses

[[Page S4597]]

do--to ensure accurate identification of individuals who use their 
services and to prevent fraud.
  Many States require social security numbers to be used in documents 
such as marriage licenses, bankruptcy records, real estate and tax 
liens, etc. These documents are, under most state laws, a matter of 
public record, which means the general public can readily gain access 
to them. Were we to make the appearance of social security numbers in 
every public record illegal, many states and third party beneficiaries 
whose business is based on providing access to public records to law 
offices and other subscribers would have to redact social security 
numbers from many hundreds of thousands of public documents. This would 
be a huge task, and it is unclear whether we would in any significant 
way, further reduce the illegal activity we are trying to prevent. In 
other words, it is unclear whether the administrative burden and cost 
would outweigh the potential benefit. This was a very real concern.
  At the same time we recognized the very real harm that could be 
caused by unlimited public access to public documents containing social 
security numbers--in many cases, right on the face of the document. 
Social security numbers in public records can be dangerous if a stalker 
knows where to look, and so I made a commitment lasts year to continue 
to look at this problem and to address it in a way that was sound and 
fair, and consistent with the overall principles and goals of the 
legislation.
  As with the other provisions in this legislation, Senator Feinstein 
and I reached a compromise.
  Under our compromise proposal there is no requirement for redaction 
of social security numbers that appear incidentally in public records, 
(i.e. not on the face of a document or in a document in a consistent 
manner). We are trying to limit access to social security numbers for 
routinely appear in a public record consistently and predictably, on 
the same page, in every document.
  For those records, records where the social security number appears 
non-incidentally, the number must be redacted before the public 
document is sold or displayed to the general public. Individuals 
requesting the document who are able to provide the social security 
belonging to the person who is the subject of the document before 
receiving the document may receive an unrelated copy of the public 
document.
  I believe that the Feinstein-Gregg Social Security Number Misuse 
Prevention Act is a well thought-out, tightly woven piece of 
legislation that has effectively recognized and balanced the many 
concerns surrounding the uses of Social Security numbers. Passing this 
legislation is one of the most important things that Congress can do 
this year to reduce identity theft and protect individual privacy while 
permitting the continued legitimate and limited uses of the social 
security number.
  I thank Senator Feinstein and look forward to continuing to work with 
her throughout the legislative process.
                                 ______